PT-2026-33848 · Nginx-Ui · Nginx-Ui

Published 2026-03-16 · Updated 2026-04-21 · CVE-2026-34403

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.5

Description All WebSocket endpoints use a gorilla/websocket Upgrader with a configuration that unconditionally accepts all origins, enabling Cross-Site WebSocket Hijacking (CSWSH). This is exacerbated by authentication tokens being stored in browser cookies without HttpOnly or SameSite attributes. Consequently, a malicious webpage can establish authenticated WebSocket connections to the instance when a logged-in administrator visits the attacker-controlled page. This can lead to the theft of sensitive server information, reading of nginx log files, triggering of system operations such as binary upgrades, and potentially achieving Remote Code Execution via interactive terminal access if OTP is not enabled.

Affected endpoints include:

• '/api/nginx/detail status/ws'
• '/api/events'
• '/api/analytic/intro'
• '/api/nginx log'
• '/api/pty'
• '/api/upgrade/perform'
• '/api/cluster/nodes/enabled'

Recommendations Update to version 2.3.5.

Fix

CSRF

Weakness Enumeration

CWE-352

CWE-1385

Related Identifiers

BDU:2026-07321

CVE-2026-34403

GHSA-78MF-482W-62QJ

Affected Products

Nginx-Ui

References · 8

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-78mf-482w-62qj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34403 · Security Note
• https://bdu.fstec.ru/vul/2026-07321 · Security Note
• https://osv.dev/vulnerability/GHSA-78mf-482w-62qj · Vendor Advisory
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.5 · Note
• https://github.com/0xJacky/nginx-ui · Note
• https://twitter.com/dailycve/status/2046692465894113439 · Twitter Post
• https://twitter.com/CVEnew/status/2046571900193923235 · Twitter Post